NecroBones wrote:
So I went to their website, and put my IP in to see why. It's not blacklisted because of my IP, or even the entire subnet(s) that it belongs to. So it's not because of any Linode spammers.
So the question should be: If Linodes ranges within GNAX are clean, why does Linode accepts GNAX having so much spammers.
They could also use cleaner datacenters.
NecroBones wrote:
They're listing our subnets because we're under "GNAXNET-AS - Global Net Access, LLC", who has had over 300 spammers in the last week out of over 92,000 IPs. 0.3% spamming?
That is 0.1% more than accepted by our standards.
So they perfectly match
Level3 listing criterias.
NecroBones wrote:
I work at an ISP. I know it's impossible to catch them all. Particularly with today's trojans, worms, viruses, and not to mention a recent one we've been fighting-- hijacked webmail logins for squirrelmail and so forth.
I even worked in an providers abuse department in Switzerland before i was employed by Admins WebSecurity.
I have knowlege what is possible and what is not for providers.
A provider can clean up their act, most of all providers have 0.05 to 0.1 % abusers per 7days comparered to their total ip space.
Having 0.3 % as GNAX is really bad, even a sewer as VERIZON has 0.27%, which means they are cleaner than GNAX compared to their size.
Also very interesting to see 105500 providers are not able to get listed at Level 3 because they stay exteme below 0.2 % abusers per 7 days.
It Is possible that a provider can have *VERY* clean ranges if he really wants!
NecroBones wrote:
uceprotect claims that we (customers with IPs in these networks) are part of the problem by supporting a carrier that doesn't stop spammers. Bull****. Blacklists that list thousands of innocent mail servers are evil, and the ISP's first priority is to make sure the traffic goes through for their paying subscribers.
No one paying a sewer is innocent.
Evil are providers not having preventive measures.
A provider hosting webservers should at least have
MODSECURITY on all servers.
Doing so makes it almost impossible to abuse weak scripts / unpatched cms / blogs / other crap dumb users might install.
A datacenter not using MODSECURITY is nothing than unprofessional.
You are part of the problem because you have accepted they ignore the problem and even think you must defend them.
NecroBones wrote:
If any of you guys are using uceprotect to block spam, I'd recommend against using them. You'll be blocking linode customers.
</rant>
You are ranting at the wrong place. You should have done so at GNAX.
Furthermore you can assume people using Level 3 for blocking do exactly know what they are doing. We have at this time listed providers as VERIZON at Level 3, so i really doubt Level 3 users will care about some webservers hosted at GNAX are also listed.
Level 3 is declared as an draconic list and used by BOFH's and other HARDLINERS out there.
Interesting to see that meanwhile also some providers are blocking at Level 3 and it does not make me whonder.
Why should a super clean provider having installed our 4 steps to prevent mailabuse allow lazy others to wast his resources and flooding his users?
Many people harrass us, because we are running a very hard and unforgiving course at UCEPROTECT-Network.
They are thinking we could be assholes which want to extort their money.
That is not true.
EXPRESSDELISTING IS AN OPTION ONLY, NOT A MUST.
I want to explain how we came to this option called "Expressdelisting".
In UCEPROTECT's early days (August 2001) the blocklists had public "removeme" Buttons, where listees could remove them self.
As spammers were beginning to abuse that with automated scripts we did secure it with a captcha. Then Spammers did hire persons in India and China to remove their listings manually.
That was the point where my predecessor got rid of "selfremovals" and then everyone was required to contact us to get removed before expiration.
If you ever run a public blocklist, you have clue what this means:
You have to read some thousand removal request per day, and all these guys are claiming to be completley innocent, and they all have fixed their problems.
Not necessary to say that 90% of them did find their way back into the list within minutes, because they had indeed NOT fixed their problems.
Somewhere in 2003 my predecessor has chosen that the only way to get out would be automatic expiration. You know what happened next, do you?
Some listees claimed that it would cost them thousands of dollars to be listed for a week, but
they would have fixed their problem and they are so sure that their problem is now fixed that THEY WOULD EVEN PAY FOR IT TO GET OUT IMMEDIATLEY.
Logic says: One would not waste money if he would't have fixed the problems.
You now know why there is an OPTIONAL Expressdelisting at UCEPROTECT.
We also think we have found a good balance between what is acceptable for someone who has really fixed his problems and needs his email and also expensive enough that spammers would not pay for.
Fees are 50 Euro for a single IP (Level 1), 150 for an allocation (Level 2), and 250 for complete ASN's (Level 3).
You have probaly seen that this is a large discount we give on Levels 2 and 3 compared with Level 1, so one can not compare us to BLARS.
And in fact: Most of those who payed have really fixed their problems and learned an unforgettable lesson: NEVER GO ONLINE AGAIN WITH AN INSECURE SYSTEM.
Ok lets come to our reasoning why we run UCEPROTECT-Network.
You know there are many public blocklists available, but they all do it wrong:
Their logic is to just stop infected machines from delivering spam to their users today.
That tactics really sucks because they can be very easy be gamed by spam-friendly providers.
It is nothing new that there are providers which are moving their spammers around in their address-space. They have no interest to block spam, because they want the spammers money as they want the money of regular users too.
Our mission is different. We want to stop all spam on this planet. Finally.
We meanwhile got so much popular that getting listed on Level 3 becomes a serios issue for providers.
I can tell you about 5 providers (within the last month) now blocking port 25 on all their dialups after they did end up in Level 3 and they have seen that we are the wrong persons to play games with.
There are 105898 AS-Numbers known at this time, but only between 250 - 300 or other said less then 0.3% are listed in UCEPROTECT-Level 3.
I guess that should tell you enough about them and their way to work.
Most people hate spam, but have no clue who is reponsible for that.
Our lookup tool is opening their eyes showing them how deep their own provider is involved in the spam problem or if he is one of the clean ones.
Assuming number of our users is growing the way it did in the last 4 years, then every provider ending up in Level 3 can enjoy his very own intranet latest by 2011/2012.
If that happens, it will be the ultimate end of spam.
This is what we and people using all our Levels for blocking want to happen.
It does not matter to us:
- If the complete anti-spam industry goes bankrupt after spam will be history.
- If spam-friendly providers will loose all their customers.
- If former spammers will have to search for real jobs.
- If no one can buy faked viagra or rolexes on the net.
- If UCEPROTECT is no longer needed in some years.
We had good lifes before spam came, and we will have good lifes after spam will be gone.
So now lets come to the point how i could be helpfull for Linode to get off Level 3:
I think you got the hint within this discussion.
Lever 3 lists ASN's. At this time Linode doesn't seems to have its own AS, thus suffering from GNAX lazyness or incompetence to clean up their mess.
We have no idea how much IP's Linode has, but we know about very small providers owning a /24 only, but having its own AS.
So why does Linode not also do so?
Linode's ranges will fell out of Level 3 automatically, because they would no longer be seens as part of AS 3595.
Claus von Wolfhausen
UCEPROTECT-Network
FAQ
Search
Members
Register
Login [ Anonymous ]
